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BSA | The Software Alliance (BSA)' welcomes the opportunity to provide feedback in 
response to the Inception Impact Assessment on a Legislative framework for the 
governance of common European Data Spaces. BSA is the leading advocate for the 
global software industry. Our members are at the forefront of software-enabled 
innovation that is fueling global economic growth by helping enterprises in every sector 
of the economy operate more efficiently. As global leaders in the development of data- 
driven products and services, BSA members have unique insights into how European 
Data Spaces could encourage the uptake of Al tools, data analytics and how they could 
further help the EU to become a leading role model for a society empowered by data to 
make better decisions — in business and the public sector. 


Data is the lifeblood of the modern digital economy — powering innovation and growth 
across the globe and enabling organizations to create new jobs, boost efficiency, drive 
quality, and improve output. BSA is strongly supportive of the European Strategy for 
Data released in February 2020, as sound and innovative data policies are fundamental 
to ensure the EU’s primary role in the global economy. 


In particular, the ability for companies to access and share data has a significant 
influence on economic development and growth, on a large scale due to its relevance 
on the development of Al. Moreover, as European and Europe-based companies face 
the unprecedented challenges born out of the COVID-19 crisis, it becomes even more 
important to ensure balanced rules and guidelines for the management of personal and 
non-personal data. In this context, BSA would like to submit the following 
recommendations with regards to the Common European Data Spaces and related 
policies. 





1 BSA | The Software Alliance (www.bsa.org) is the leading advocate for the global software industry before governments 
and in the international marketplace. Its members are among the world’s most innovative companies, creating software 
solutions that spark the economy and improve modern life. With headquarters in Washington, DC, and operations in 
more than 30 countries, BSA pioneers compliance programs that promote legal software use and advocates for public 
policies that foster technology innovation and drive growth in the digital economy. 


BSA’s members include: Adobe, Akamai, Atlassian, Autodesk, Bentley Systems, Box, Cadence, Cloudflare, 
CNC/Mastercam, IBM, Informatica, Intel, Intuit, MathWorks, McAfee, Microsoft, Okta, Oracle, PTC, Salesforce, 
ServiceNow, Siemens Industry Software Inc., Sitecore, Slack, Splunk, Trend Micro, Trimble Solutions Corporation, Twilio, 
and Workday. 
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Common European Data Spaces. The creation of “Common European Data Spaces” 
in strategic sectors as foreseen in the European Strategy for Data can greatly increase 
the innovation potential of Europe’s economy with immense benefits to society. These 
data spaces need to be accessible to all market participants, both commercial and non- 
commercial, and enable an ecosystem where all participants can use and access data 
in a trusted, safe and secure environment. BSA would like to stress that a regulatory 
framework for the data governance of these data spaces should lay out high-level rules 
for open, transparent and structured stakeholder involvement and decision-making 
processes to provide the necessary flexibility and legal certainty to empower market 
participants and the public sector to participate in data spaces. 


However, a horizontal legislation on data governance should not be prescriptive and 
focus on setting high-level rules aimed at addressing compatibility, interoperability and 
participatory issues around data spaces. Specific vertical data spaces may need 
adapted holistic data governance rules to ensure that innovation is not constrained within 
these sectors, and that trust is maintained. Data spaces should not constrain innovation 
in fast-moving ecosystems. 


The development and adoption of the contemplated data spaces can and should be 
implemented in phases. For example, the data spaces can begin with creating open data 
environments, including government data released under open data licenses, to develop 
a culture of data sharing and free exchange among participants. Targeting open data 
first will enable the development of the data governance practices, standards, and data 
licensing infrastructure needed to establish robust data sharing environments without 
the complexity of managing dueling commercial interests. 


While these data spaces will be populated by stakeholders such as businesses, 
research institutions, individuals, and governmental entities, the scope should clearly 
identify what types of data will feed into the data spaces. This will require a continuous 
dialogue between policymakers and all relevant stakeholders. Finally, the data spaces 
should allow for participation from a broad range of stakeholders, and should place all 
market players who comply with European legislation and the EU Acquis, regardless of 
their size and their origin, on equal footing. 


Promote Voluntary Industry Data Sharing. While there is increasing recognition of the 
collective benefits of data sharing, the establishment of collaborative data sharing 
arrangements can be impeded by a range of technical, legal, and organizational 
challenges. In particular BSA encourages the European Commission to support the 
development, availability, and adoption of tools and best practices that make it easier 
and less expensive to share data in ways that are consistent with rigorous privacy 
expectations. Technical tools, such as application programming interfaces (APIs), can 
facilitate data exchanges that are faster and more secure than traditional transfers and 
create opportunities for empowering the public with greater access to their own data. 
Some level of standardization may be required in this area, but any standards developed 
should be market-led, developed in cooperation with industry. Further, any standards 
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should recognize the specificities of sectors and use cases to which they may apply, and 
take into account and build upon the many existing standards in this area. 


In addition to technical tools, the European Commission should look for opportunities to 
promote the development and use of standardized data licensing models. Much as the 
development of standardized open source licenses gave rise to anew model for software 
innovation, standardized data license agreements can facilitate new collaborative 
approaches for sharing data resources. The Linux Community Data License Agreement? 
and the Open Use Data Agreement? are good examples of industry efforts to create tools 
that will democratize the value of data by making it easier for all stakeholders to 
voluntarily share data in a manner that is predictable and trustworthy. 


Improved access to data need not come at the expense of privacy. Indeed, a range of 
privacy-enhancing technologies and data governance structures can enable value-added 
uses of data without compromising the confidentiality or security of the underlying data. 
To that end, the European Commission should promote the use of privacy enhancing 
technologies — such as differential privacy, homomorphic encryption, and federated 
machine learning — to create opportunities for sharing data while preserving individual 
privacy. The European Commission should likewise support the development of 
innovative data governance structures — such as data trusts, data cooperatives, and data 
commons - that facilitate public and private sharing of data in ways that preserve privacy 
while enabling participants to benefit from the analysis of potentially sensitive data. 
Investments in R&D and the creation of regulatory sandboxes can also help spur the 
development of such arrangements. 


In general, BSA is supportive of the role of data intermediaries to enhance private 
exchanges of data in the data spaces. They can be cost-effective ways to ensure that 
high-quality data is pooled and shared in a transparent manner, which in turns contributes 
to a significant decrease in costs for data sharing, In this context, we welcome further 
Clarification by the European Commission on the role, nature and objectives of data 
intermediaries and to foster common understanding at EU level. 


To foster the data economy and enable data spaces, a more uniform interpretation and 
application of the GDPR is necessary to move towards a higher degree of harmonization 
between Member States. Providing more legal certainty through EDPB guidelines and a 
standardized industry approach which includes a risk-based view to the anonymization 
of data are key factors to incentivize more data sharing and usage. 


Furthermore, the proposed e-Privacy regulation should ensure consistency with the 
GDPR requirements (for instance with regard to the legal grounds for processing of 
personal data). As the e-Privacy regulation in its latest drafting will also apply to non- 
personal data, the scope of the regulation needs to be clarified to make sure that the 
uptake of data usage in all sectors and technologies such as cloud computing, Al or 
edge computing are not negatively impacted. Additionally, outstanding cybersecurity 





2 The Linux Foundation Projects, Community Data License Agreement, https://cdla.io/ 
3 Microsoft, The Open Use of Data Agreement, https://github.com/microsoft/Open-Use-of-Data-Agreement 
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issues — including software updates — in the proposed e-Privacy draft Regulation need 
to be resolved to avoid unnecessary and unintended practical issues. 


Access to Government Data and Public Sector Information. Government-generated 
data is a resource that can serve as a powerful engine for creating new jobs and 
promoting economic growth. At both the local and national level, governments collect 
and generate vast quantities of data that can be harnessed in the development of Al 
systems, data analytics and more broadly would allow for a stronger and industry more 
responsive to the needs of customers. 


In this context: 


a. Putting government-held data to use: Sound data policies should ensure that any 
non-sensitive government-generated data asset is made freely available to the 
public in machine-readable formats. This data — a resource whose full potential 
would otherwise go unrealized — can improve services and lower prices. For 
instance, an Al system designed to improve supply chain efficiency might rely on 
government data about historical traffic flows, law enforcement event advisories, 
and weather patterns to recommend delivery routes that minimize congestion, 
reduce emissions, and improve public safety. 

b. Preventing data lock-up through procurement: Governments should carefully 
consider the effect that procurement policies can have on the availability of data. 
As a general matter, governments should avoid service agreements that would 
grant exclusive access or use rights to government datasets to any single private 
entity. Increasingly, government data is being generated by third-party vendors. 
For instance, local transit authorities may contract with third-party vendors to 
analyze data generated by buses and trains, or by sensors embedded in street 
lights and roadways. Governments contracting for such services should ensure 
that any statistical data created or maintained on its behalf as part of the 
agreement is not subject to access or use restrictions. Rather, data provided to 
governments as part of such procurement contracts should be treated like any 
other government data asset and should be made freely accessible for public 
use. 


BSA supports the recently updated EU Open Data Directive and agrees with the 
European Commission's efforts to make specific high-value public datasets available, 
where appropriate, as there is significant potential in its re-use in new products and 
services. 


Facilitate Value-Added Data Services. Data is the key to growth in all sectors of the 
economy, but each piece of data has little inherent value. It is only when used as an input 
to other value-added services that it contributes to the projected $15 trillion addition to 
global GDP by 2030.4 Policies that artificially increase the costs for acquiring data will 





4 BSA, What’s the Deal with Big Data, available at https://data.bsa.org/wp- 
content/uploads/2015/12/bsadatastudy_en.pdf 
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ultimately increase the costs of innovative technologies for customers and decrease the 
incentive to develop and use new technology — potentially reducing overall consumer 
welfare. The European Commission should pursue policies that facilitate the business-to- 
business exchange of data, including by: 


a) Ensuring companies can enter enforceable contracts that create data sharing 
arrangements; 

b) Avoiding the creation of new rights in business data that could add unnecessary 
transaction costs; and 

c) Allowing companies to freely perform data analytics, including Text and Data 
Mining (“TDM”), on any content to which they have lawful access. 


BSA has been a strong advocate for a mandatory exception for TDM in the EU Copyright 
Directive,° and strongly encourage the European Commission to ensure the appropriate 
implementation of the text of Art. 4 of the Directive, to ensure strong protections for 
rightsholders, while providing for legal certainty for data innovators and researchers. 


Cloud and edge computing. The European Strategy for Data suggests creating a 
Cloud Rulebook that would serve as a repository of applicable rules, including codes of 
conduct and certifications for cloud services. BSA welcomes the idea to centralize and 
document industry-led standards that can bring more clarity to customers when 
navigating the cloud landscape. In this context, BSA would support the idea of setting- 
up a cloud services marketplace, that would help demonstrate the vibrant market for 
cloud solutions in Europe, a potential that is still under tapped. However, this should not 
lead to measures at EU or national levels that may impose market access or other 
unjustified barriers, such as preferential treatment or data localization measures. 


BSA stresses that the approach to strengthening Europe’s cloud infrastructure should 
be inclusive, open and based on trust and credentials. Strengthening technological 
capacity-building and working with like-minded partners that have strong commitments 
to Europe go hand-in-hand, regardless of the location of their headquarters. 
Transparency, interoperability and openness should be the key fundamentals to an 
open, secure and future-facing European data infrastructure. Also, and as the Strategy 
notes, there is a low cloud uptake in Europe (with one 1 company in 4 on average, only 
1 in 5 for SMEs‘) including in the European public sector. We encourage the European 
Commission to further promote cloud adoption in both the private and public sector 
throughout the European Union. Initiatives that can promote the legal certainty around 
the use of cloud can be helpful, but they also need to be consistently implemented across 
Member States. 


The recent and still ongoing COVID-19 crisis has shown that using software and cloud 
services can improve the ability of employees to collaborate, companies to reach 
consumers, and governments to reach citizens in a secure and efficient manner. Cloud 





5 For more information please visit https://www.bsa.org/news-events/news/bsa-applauds-eu-decision-to-enact- 
mandatory-exception-for-text-and-data-mining-in-copyright-directive 

6 https://ec.europa.eu/eurostat/statistics-explained/index.php/Cloud_computing_- 
_Statistics_on_the_use_by_enterprises 
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has been a catalyst for innovation during Covid-19 and ensured continuity of public 
service. In this regard, the recently released BSA Response and Recovery Agenda’ 
highlights a number of policy priorities and strategic initiatives that could be fostered in 
the EU to enable governments and their citizens to prepare for and implement increased 
remote working, resilient education systems, and other remote-based activities, such as 
remote medical consultations. Among these recommendations, encouraging and 
enabling the use of software and cloud services for continued business and government 
operations as well as promoting responsible migration to cloud services are essential to 
contribute to the success of the digital transformation of European industry and society. 


Lastly, as the European Strategy for Data rightly points out “European companies 
operate in a connected environment that goes beyond the EU’s borders, so that 
international data flows are indispensable for their competitiveness.” The free flow of 
data across borders is critical for the services that sustain global commerce, improve 
health and safety, promote social good, and enable the technologies of the future. 


BSA would welcome the opportunity to further explore ways to support the Commission’s 
efforts to develop policies and initiatives to drive better cloud adoption throughout the 
EU. 





7 https://www.bsa.org/files/policy-filings/05272020bsaresponserecoveryagendaa4.pdf 


Avenue des Arts 44 P +32 (0)2 274 13 10 
1040 Brussels W bsa.org 
Belgium EU Register of Interest Representatives 7503938 3277-48 


